{"id":"CVE-2026-80522","title":"crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()\n\nPerform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way\nit is done in tegra_…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < cd6991001bf0681ed0bcf21f9cc3d261d749b2bb","Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < 99a18e1d979e0fad3aaf9c65ae6696897c1d9869","Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < c6237834d9994de209cb90c7a2c461247bce8e90","Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < 360f2974fcea49c61f6d6f81554741a9eeee7168","Linux 6.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:16:31.536900Z"},"published":"2026-08-26","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:26:24.520Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80522","references":[{"url":"https://git.kernel.org/stable/c/cd6991001bf0681ed0bcf21f9cc3d261d749b2bb"},{"url":"https://git.kernel.org/stable/c/99a18e1d979e0fad3aaf9c65ae6696897c1d9869"},{"url":"https://git.kernel.org/stable/c/c6237834d9994de209cb90c7a2c461247bce8e90"},{"url":"https://git.kernel.org/stable/c/360f2974fcea49c61f6d6f81554741a9eeee7168"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02221,"ingestedAt":"2026-10-16T19:46:24.320Z","slug":"CVE-2026-80522","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()\n\nPerform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way\nit is done in tegra_ccm_crypt_init(). The current formulae may lead to a\ncrash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize\nremains zero. Then a decrypt operation with incorrect rctx->cryptlen will\nlead to a write beyound rctx->dst_sg buffer.\n\nAs a follow-up cleanup delete struct tegra_aead_ctx->authsize field since\nit appears to be completely unused. Also simplify tegra_ccm_setauthsize()\nand tegra_gcm_setauthsize() functions respectively.\n\n## Affected\n\n- `Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < cd6991001bf0681ed0bcf21f9cc3d261d749b2bb`\n- `Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < 99a18e1d979e0fad3aaf9c65ae6696897c1d9869`\n- `Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < c6237834d9994de209cb90c7a2c461247bce8e90`\n- `Linux >= 0880bb3b00c855fc244b7177ffdaafef4d0aa1e0 < 360f2974fcea49c61f6d6f81554741a9eeee7168`\n- `Linux 6.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}